However, it turns out that naive composition using this trivial analysis
gives values of \(\varepsilon \gg 10^4\)  for accurate neural networks,
implying a ratio of adversary true positive to false positive bounded by \(e^{10^4}\) —and hence not meaningful.
Thus, Abadi et al. [1]} develop the Moments Accountant: an
improvement of Bassily et al. [2]} which introduces a
much more sophisticated tool to analyze DP-SGD that can prove, for the same
algorithm, values of \(\varepsilon < 10\) . Since then, many works [3]}, [4]}, [5]}, [6]}, [7]}, [8]} improved the analysis of the Moments Accountant analysis to get better theoretical privacy bounds.
